nxlog source IP addresses | Log collection solutions

#1 rbeeler 6 years ago

This is a two part problem relating to source IP addresses used by nxlog:

We have several systems that use 192.168.x.x addresses as their source - not sure what this is about, but I'm thinking it may be related to the nxlog service starting before the Windows network services are completely up?
We have several systems that have multiple IP addresses (interfaces) and we would like to force nxlog to report from one IP address. Is there a way to do this?

Thanks for your help.

Permalink

#2 b0ti Nxlog ✓ 6 years ago

#1 rbeeler

This is a two part problem relating to source IP addresses used by nxlog: We have several systems that use 192.168.x.x addresses as their source - not sure what this is about, but I'm thinking it may be related to the nxlog service starting before the Windows network services are completely up? We have several systems that have multiple IP addresses (interfaces) and we would like to force nxlog to report from one IP address. Is there a way to do this? Thanks for your help.

This is all handled on the networking level by the OS kernel. The IP address that the application (NXLog) sends TCP packets from is controlled by networking/routing and there is nothing you can do to change this in the application.

It is only possible to change the IP address for UDP packets via the om_udpspoof module available in the NXLog EE.